Browse public community intelligence reports, source analysis, and threat research.
46 intel reports
The TeamPCP campaign hijacked the @bitwarden/cli npm package to distribute a sophisticated stealer targeting developer credentials, cloud secrets, and AI configuration files.
North Korean state actor Sapphire Sleet targets cryptocurrency and finance sectors using social engineering and multi-stage AppleScript-based infection chains on macOS.
The threat actor UAT-10362 is targeting Taiwanese NGOs and universities with a modular Lua-based stager called LucidRook and a reconnaissance tool named LucidKnight.
Multiple China-aligned threat actors, including Stately Taurus and clusters CL-STA-1048/1049, are targeting a Southeast Asian government using a diverse toolkit of USB-propagated malware, novel loaders, and remote access Trojans.
Threat actor TeamPCP compromised the Trivy vulnerability scanner and associated GitHub Actions to exfiltrate cloud and CI/CD credentials via poisoned tags and binaries.
The threat actor TeamPCP compromised Aqua Security's Trivy project, injecting credential-stealing malware into official releases and forcing malicious updates to GitHub Actions.
